ClickFix is a social engineering technique that uses fake CAPTCHA pages to trick users into pasting malicious commands into Run dialogs or terminals, executing payloads in memory via LOLBins without triggering traditional AV or EDR signatures. The threat has commoditized through MaaS subscriptions ($250–$1,800), expanded its payload catalog beyond infostealers to include RATs, loaders, and rootkits, and is actively evolving with variants like CrashFix, FileFix, PromptFix, and ConsentFix. ReversingLabs released an open-source multi-condition YARA rule that detects ClickFix lures by correlating fake verification characteristics, PowerShell payload indicators, and clipboard manipulation before payload execution.
MaaS
12 posts
The tale of ClickFix: 5 takeaways from RL’s new threat report TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains TELEPUZ is a rapidly evolving modular MaaS malware delivered via ClickFix social engineering and VIDAR second-stage downloader chains. The 64-bit Windows DLL payload uses indirect syscalls, NTDLL unhooking, AMSI/ETW patching, and custom RC4 encryption for defense evasion, while establishing persistence as a Windows service and communicating over WebSockets with fallback C2 resolution via Telegram, Steam, DNS records, and Polygon blockchain smart contracts. The malware supports 36 commands including process hollowing, keylogging, credential theft, browser cookie extraction, and a WebInjector module that abuses Chrome DevTools Protocol to manipulate financial web forms in real-time.
Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation A financially motivated campaign active in April 2026 delivers Vidar stealer and XMRig cryptocurrency miner to victims worldwide via malvertising for fake software cracks. The campaign uses the Factory-v3 Go loader framework with per-build unique binaries, fabricated Authenticode certificates impersonating legitimate brands, file-size inflation up to 491 MB to evade sandbox analysis, and an in-memory AMSI bypass. Vidar exfiltrates browser credentials, cookies, and crypto wallets to C2 servers, while XMRig mines Monero using the pool.supportxmr.com mining pool. The operator receives Telegram notifications for each new infection.
Vidar Infostealer Being Spread through Phishing Emails Vidar, a C++-based MaaS infostealer active since 2018, is being distributed via phishing emails disguised as resumes and copyright infringement notices targeting Korean users. The malware uses a Go-based packer to evade detection and employs a Dead Drop Resolver technique via Telegram and Steam profile pages to retrieve C&C server addresses. Once executed, Vidar exfiltrates browser credentials, cryptocurrency wallets, Discord/Telegram/Steam data, Azure tokens, FTP credentials, and screenshots, with anti-debugging and anti-VM techniques to hinder analysis.
Novel Java-Based QuimaRAT Targets Windows, macOS, and Linux QuimaRAT is a cross-platform, Java-based remote access trojan sold as a malware-as-a-service subscription on the dark web. It targets Windows, macOS, and Linux systems by embedding JNA native libraries for multiple architectures within a JAR archive built for Java SE 8. The RAT decrypts an internal configuration file using repeating-key XOR, performs anti-analysis and virtualization checks, establishes persistence via OS-specific mechanisms, and maintains resilient C2 communication through HANDSHAKE and HEARTBEAT protocols. With 23 implemented commands and 212 protocol-only commands, the platform is highly extensible through runtime modules and fileless payloads.
StealC You Later: Proofpoint and IBM X-Force Support Operation Endgame Disruptions Proofpoint and IBM X-Force collaborated with Europol and Microsoft's Digital Crimes Unit to disrupt the StealC malware-as-a-service ecosystem as part of Operation Endgame, seizing 66 domains, 296 servers, and over 25.6 million stolen credentials. Researchers discovered a directory traversal vulnerability in the StealC PHP C2 panel's filename handling during ZIP extraction, which was exploited by law enforcement to access and seize C2 servers. The teams also built a StealC bot emulator to track affiliate infrastructure and observe payload delivery chains, revealing StealC's loader functionality distributing a broad range of secondary malware including ransomware, RATs, and additional stealers.
StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them StealC is a C++ malware-as-a-service infostealer that harvests credentials, cookies, and session tokens from browsers, email clients, crypto wallets, and gaming platforms, using APC injection to bypass Chromium App-Bound Encryption. Amadey is a modular MaaS loader that delivers StealC and other payloads through a rich backdoor command set including process injection, SOCKS proxying, RDP enablement, and hidden admin account creation. Microsoft DCU disrupted over 200 C2 domains and IPs associated with both threats in a coordinated action with Europol on June 24, 2026.
ESET takes part in Operation Endgame to disrupt Amadey and Stealc ESET Research contributed to Operation Endgame, a coordinated global disruption targeting the Amadey botnet and Stealc infostealer MaaS ecosystems. The operation seized or rendered inoperative approximately 50 domains and nearly 200 active IP-based C&C servers. ESET provided technical analysis, C&C server lists, RC4 encryption keys, campaign/build identifiers, and clustering methodology based on long-term tracking of both malware families. The fragmented, affiliate-operated infrastructure model used by both services required advanced graph-based clustering of RC4 keys, build IDs, and C&C URL paths to identify high-priority targets for disruption.
From PDB strings to MaaS: Tracking a commodity BadIIS ecosystem used by Chinese-speaking threat Cisco Talos has identified a commodity BadIIS malware ecosystem operating under a Malware-as-a-Service (MaaS) model, primarily used by Chinese-speaking threat actors for SEO fraud and traffic manipulation. The developer, known as 'lwxat', provides a dedicated builder and sophisticated service-based installers that ensure persistence on compromised Windows IIS servers while evading detection through custom Base64 encoding and service impersonation.
Why AMOS matters: The macOS malware stealing data at scale Sophos MDR investigated a macOS infostealer infection attributed to an AMOS (Atomic macOS) variant. The attack leverages ClickFix social engineering to trick users into running a malicious Terminal command, which initiates a multi-stage infection chain. The malware captures the user's system password via a spoofed prompt, evades analysis by checking for virtualized environments, and exfiltrates sensitive data like Keychain and browser credentials before establishing persistence via a LaunchDaemon.
Scams, Slaves and (Malware-as-a) Service: Tracking a Trojan to Cambodia’s Scam Centers An Android banking trojan is being distributed globally as a Malware-as-a-Service (MaaS) from scam centers in Cambodia, utilizing forced labor to conduct social engineering campaigns. The malware features extensive surveillance capabilities, including SMS interception and biometric capture, allowing attackers to bypass KYC and OTP protections to commit direct financial fraud.
The AI Malware Surge: Behavior, Attribution, and Defensive Readiness AI-assisted malware development has rapidly matured, driven largely by the adoption of models like DeepSeek R1, which lowers the barrier to entry for threat actors. This surge has resulted in a high volume of structurally novel malware, including infostealers, RATs, and ransomware, many of which evade traditional signature-based detection while leaving distinct LLM-generated artifacts in their code.
